Thompson Coburn Data Breach Settlement: What to Know

At a glance

Status

Pending final approval

Defendant

Thompson Coburn LLP

Settlement fund

$7,500,000

Claim deadline

July 23, 2026

No-proof cash option

Yes — ~$150 estimated pro-rata cash payment ('Cash Payment B'), no proof required -- official FAQ states the amount 'could be higher or lower' depending on total claims filed, it is not a guaranteed flat $150, or up to $5,000 documented out-of-pocket losses ('Cash Payment A')

Max documented payout

$5,000

Administrator

Simpluris

Official site

tcdatasettlement.com

Court

Circuit Court of the City of St. Louis, Missouri

Case number

2622-CC00320, No. 2622-CC00320

Last verified July 16, 2026

Key dates

Milestone	Date	What it means
Claim deadline	July 23, 2026	Last day to file for a payment
Opt-out (exclusion) deadline	August 7, 2026	Last day to leave the settlement and keep the right to sue
Objection deadline	August 7, 2026	Last day to object to the terms
Final approval hearing	August 27, 2026	When the judge decides whether to approve the settlement
Expected payout	Not yet scheduled	Payments are not sent until after final approval and any appeals

Where to file

Thompson Coburn LLP Data Breach Settlement (Salazar v. Thompson Coburn) is administered by Simpluris. The only place to file is the official settlement website:

Verify on the official site

tcdatasettlement.com

Filing is free. No legitimate settlement charges a fee to file a claim.

You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.

What Happened

Thompson Coburn LLP, a law firm, suffered a cyberattack in May 2024. The firm later notified individuals that their personal information had been exposed as a result, and it sent notice to people whose data it held not because they were the firm's own clients, but because the firm was acting as outside counsel for other organizations. The court-authorized settlement notice specifically names Presbyterian Health Services among the entities whose information was affected, alongside the firm's own current and former clients.

That is the detail that trips most people up. If you received a notice about this settlement and never hired Thompson Coburn, you are not imagining a mistake. A hospital or another organization can hand a law firm access to patient or customer records for legal work, and if that firm's systems are breached, the people whose records it was holding get pulled into the notice, even though they never had a direct relationship with the firm.

A lawsuit followed, Salazar v. Thompson Coburn, filed in the Circuit Court of the City of St. Louis, Missouri, case number 2622-CC00320. The parties reached a proposed settlement to resolve the claims rather than litigate them to a verdict.

Where the Settlement Stands Right Now

As of July 2026, this settlement has not been finally approved. It is in the pending final approval phase, which means a judge has reviewed the proposed deal but has not yet signed off on it. The Circuit Court of the City of St. Louis has scheduled a final approval hearing for August 27, 2026, at 1:30 p.m. Central Time, at 10 N. Tucker Blvd., St. Louis, MO 63101, according to the court-authorized Long Form Notice and the settlement FAQ. The administrator's own dates summary page lists a different date, August 22, 2026, so if you plan to attend the hearing or file an objection in person, confirm the current date on the official site before making travel plans.

Until that hearing happens and the judge approves the settlement, no money moves. There is no confirmed payment date, and any site or message that promises a specific payout date before final approval is getting ahead of the actual process. If the settlement is approved without changes, payments typically follow some weeks or months after, but that timeline is not yet set here.

Who Is in the Class

The court has defined the Settlement Class as "all persons in the United States who were sent notice of the Data Incident as identified in the Class List," a list compiled by Thompson Coburn. In practice, that reaches beyond the firm's own clients: the settlement notice names Presbyterian Health Services, alongside the firm's current and former clients generally, among the entities whose information was compromised, accessed, or otherwise impacted by the breach. If you received a written notice about this incident, you are almost certainly part of the class the settlement describes, whether or not you ever had a direct relationship with Thompson Coburn itself.

The underlying record does not specify every category of data exposed, so if your notice listed something more specific, such as a Social Security number or medical record details, treat the notice you actually received as the more complete description of what happened to your own information.

How Much You May Realistically Get

There are two payment tiers, and most people should expect the smaller one. The realistic outcome for someone who files without any documentation is an estimated pro rata cash payment of roughly $150, called Cash Payment B. That figure is not guaranteed. The settlement's own FAQ says the actual amount could end up higher or lower than $150 once the total number of valid claims and the court-approved fees and costs are known. This is a common fund; it gets divided among however many people file, so the more people who claim, the smaller each no-proof share can get.

The second tier, Cash Payment A, reimburses documented out-of-pocket losses connected to the breach, up to $5,000. This is a ceiling, not a typical payment. Very few claimants in a settlement like this actually document losses anywhere near that maximum, and this tier is only for people who genuinely spent money or lost time dealing with fraud, credit monitoring fees, or identity restoration tied to this specific breach.

What Proof You Need, by Tier

For the no-documentation pro rata payment, the settlement does not require proof of loss; you attest that your data was involved and file a claim. For the documented-loss reimbursement, you need supporting records, such as bank or credit card statements, receipts, or other paperwork tying a specific loss to this breach. Claims without adequate support in that tier are the ones most likely to be reduced or denied, so keep any paperwork you already have before you file.

How to File

Claims are submitted through the official settlement website, tcdatasettlement.com, which is run by the court-appointed administrator, Simpluris. The site walks claimants through choosing a payment tier and, for documented losses, uploading supporting records. RecordingLaw.com is not the administrator, the court, or a filing venue; we are an independent publisher explaining the case, and any claim has to be filed on the official site itself.

One detail is easy to miss because the dates run in an order that feels backward. The claim deadline, July 23, 2026, comes before the exclusion and objection deadlines, both set for August 7, 2026. That means someone who decides not to file a claim, or who simply misses the claim deadline, can still act by August 7, and there are two different ways to do it. Opting out means leaving the class entirely: you give up any payment from this fund, but you keep the right to sue Thompson Coburn on your own over the same breach. Objecting is different: you stay in the class and remain eligible for a payment, but you tell the court in writing, before the hearing, that you think some part of the deal is unfair. Both are real, separate choices from simply filing a claim, and both stay open for about two more weeks after the claim window closes.

Because this breach reached people through a law firm's outside-counsel work rather than a company they signed up with directly, be alert to any text or email that references this settlement or a law firm data breach and asks you to click a link, confirm your Social Security number, or pay a fee to "process" your claim. The real administrator, Simpluris, does not charge to file, and legitimate settlement communications will point back to tcdatasettlement.com rather than asking for payment information up front.

If You Missed the Deadline or Have Not Filed

If you are reading this after July 23, 2026, and you did not file a claim, the claim window described above has likely closed for you, though you may still be able to opt out until August 7, 2026, if you want to preserve your own right to sue. Either way, there are concrete steps worth taking regardless of where this settlement stands.

Place a free credit freeze with all three major credit bureaus, Equifax, Experian, and TransUnion. A freeze is free by federal law and blocks most new accounts from being opened in your name. If you find evidence your information has actually been misused, the Federal Trade Commission's IdentityTheft.gov walks you through reporting it and building a personal recovery plan. Because this breach touched health-related records for many class members, including protected health information and health insurance details described in the settlement notice, it is also worth reviewing your explanation-of-benefits statements from your health plan for any service or claim you do not recognize, not just your bank and credit card statements.